GCVE-110-OSM-2026-4054

[osmalyze-auto] Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. [osmalyze-auto] Entrypoint: dist/index.js (bin: ./dist/index.js) Exfil: https://cloud.uipath.com/draft/2024-12/operate (custom-c2, recovery: plaintext in dist/packager-tool.js) Payload: dist/validation.js Secondary files: dist/packager-tool.js Key findings: - Corporate Environment Targeting in dist/packager-tool.js: "tMode)(it, `property ${prop} matches pattern ${pat} (use allowMatch" - Corporate Environment Targeting in dist/validation.js: "tMode)(it, `property ${prop} matches pattern ${pat} (use allowMatch" - Dynamic Code Execution in dist/index.js: "exec(val)" - Dynamic Code Execution in dist/packager-tool.js: "exec(version3)" - Data Encoding for Exfiltration in dist/packager-tool.js: "btoa(" IOCs: - urls: https://jmespath.org/, https://cloud.uipath.com/draft/2024-12/operate, https://cloud.uipath.com/draft/2024-12/entry-point, http://www.omg.org/spec/BPMN/20100524/MODEL, http://www.omg.org/spec/BPMN/20100524/DI (+8 more) - domains: jmespath.org, this.it, cloud.uipath.com, www.omg.org, bpmn.io (+10 more) - payloadFileHash: e96881e69aada731d80eeb57877948673545d9b43ac77a477c48fcaa832c0fcc